Windows AFD WinSock Use-After-Free Privilege Escalation
Use-after-free in Windows Ancillary Function Driver for WinSock (afd.sys) lets local attackers gain SYSTEM privileges via race condition. Actively exploited by Lazarus.
- Vendor
- Microsoft
- Product
- Windows (multiple versions)
- CVSS
- 7.0
- EPSS (exploit probability)
- 8.6%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-68820 being exploited?
Yes. CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. It is also listed in ENISA's EU Vulnerability Database (EUVD) exploited list.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 8.6% (scored October 30, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ LISTED ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-68820 timeline
- First 0dayNews coveragesame day as NVD
- Added to CISA KEVsame day as NVD
- Added to EU KEV (ENISA)same day as NVD
- Published to NVD
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (14 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-68820 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys), the kernel-mode driver that backs Windows socket operations. An authorized local attacker can trigger a race condition that corrupts freed memory, leading to SYSTEM privilege escalation.
Microsoft patched this in the August 2026 Patch Tuesday release. BleepingComputer reports that North Korea’s Lazarus group deployed the FudModule rootkit using this vulnerability before the patch was available — making it a confirmed zero-day exploitation in targeted campaigns.
Affected products: Windows (all actively supported versions as of August 2026 Patch Tuesday).
Mitigation: Apply the August 2026 Patch Tuesday cumulative update. No viable workaround exists for this class of kernel driver flaw; patching is the only remediation.
Priority: Immediate — active exploitation confirmed.
Other Microsoft Windows CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-96951 Microsoft Windows Command Injection Vulnerability | [ HIGH ] | 8.8 | 9.8% | |
| CVE-2026-85880 Microsoft Windows ALPC Heap Buffer Overflow Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 0.4% | |
| CVE-2026-81963 Microsoft Windows Update Stack Link-Following Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 7.1% | |
| CVE-2008-4250 Microsoft Windows Buffer Overflow Vulnerability | [ CRITICAL ] | 9.8 | 98.8% | |
| CVE-2026-32202 Microsoft Windows Protection Mechanism Failure Vulnerability | [ MEDIUM ] | 4.3 | 71.3% | |
| CVE-2025-60710 Microsoft Windows Link Following Vulnerabilityransomware use | [ HIGH ] | 7.8 | 4.6% | |
| CVE-2023-36424 Microsoft Windows Out-of-Bounds Read Vulnerability | [ HIGH ] | 7.8 | 12.1% | |
| CVE-2008-0015 Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability | [ HIGH ] | 8.8 | 76.6% |
